Security and Communication Networks

Research Article

Real-Time Malware Process Detection and Automated Process Killing

Table 8

Summary of process killing models, validation and test set score metrics [Table 1 of 3].


Model	Val			Test
Model	f1	tnr	tpr	f1	tnr	tpr

AdaBoostModel_glo_pro	77.58	55.46	91.60	67.04	49.80	88.67
AdaBoostModel_glo_pro mean process tree	78.01	55.46	92.44	66.75	50.48	87.59
AdaBoostModel_glo_pro process tree min alerts: 1	78.87	55.46	94.12	62.29	34.03	90.35
AdaBoostModel_glo_pro process tree min alerts: 2	78.87	55.46	94.12	62.29	34.03	90.35
AdaBoostModel_glo_pro process tree min alerts: 3	78.87	55.46	94.12	62.29	34.03	90.35
AdaBoostModel_glo_pro process tree min alerts: 4	78.87	55.46	94.12	62.29	34.03	90.35
AdaBoostModel_glo_pro rolling mean window: 2	79.22	70.59	84.87	69.57	60.88	84.88
AdaBoostModel_glo_pro rolling mean window: 3	79.37	72.27	84.03	69.59	61.53	84.39
AdaBoostModel_glo_pro rolling mean window: 4	80.67	80.67	80.67	68.44	67.80	77.34
AdaBoostModel_glo_pro sum alerts min: 2	80.66	78.15	82.35	69.35	66.58	79.89
AdaBoostModel_glo_pro sum alerts min: 3	81.20	83.19	79.83	67.83	70.92	73.88
AdaBoostModel_glo_pro sum alerts min: 4	80.87	84.87	78.15	65.92	73.32	69.00
AdaBoostModel_pro	75.34	47.06	92.44	65.64	45.79	88.89
AdaBoostModel_pro mean process tree	75.86	48.74	92.44	65.74	47.83	87.59
AdaBoostModel_pro process tree min alerts: 1	75.68	45.38	94.12	60.31	26.46	91.17
AdaBoostModel_pro process tree min alerts: 2	75.68	45.38	94.12	60.31	26.46	91.17
AdaBoostModel_pro process tree min alerts: 3	75.68	45.38	94.12	60.31	26.46	91.17
AdaBoostModel_pro process tree min alerts: 4	75.68	45.38	94.12	60.31	26.46	91.17
AdaBoostModel_pro rolling mean window: 2	78.03	64.71	86.55	69.35	59.63	85.47
AdaBoostModel_pro rolling mean window: 3	77.99	67.23	84.87	68.91	59.20	84.99
AdaBoostModel_pro rolling mean window: 4	80.83	79.83	81.51	69.01	66.44	79.40
AdaBoostModel_pro sum alerts min: 2	81.12	75.63	84.87	67.91	61.06	81.68
AdaBoostModel_pro sum alerts min: 3	81.17	80.67	81.51	66.64	64.97	76.42
AdaBoostModel_pro sum alerts min: 4	79.66	80.67	78.99	64.25	68.12	70.14
AdaBoostModel_pro_tree	75.08	47.73	94.96	64.12	30.58	86.60
AdaBoostRegression_pro_process	56.63	100.00	39.50	15.06	97.92	8.40
DTModel_glo_pro	84.53	71.43	94.12	71.41	58.19	90.62
DTModel_glo_pro mean process tree	85.93	73.95	94.96	71.49	59.48	89.70
DTModel_glo_pro process tree min alerts: 1	84.64	70.59	94.96	65.59	42.42	91.27
DTModel_glo_pro process tree min alerts: 2	84.64	70.59	94.96	65.56	42.34	91.27
DTModel_glo_pro process tree min alerts: 3	84.64	70.59	94.96	65.56	42.34	91.27
DTModel_glo_pro process tree min alerts: 4	84.64	70.59	94.96	65.56	42.34	91.27
DTModel_glo_pro rolling mean window: 2	88.70	88.24	89.08	75.09	70.49	86.94
DTModel_glo_pro rolling mean window: 3	87.87	87.39	88.24	74.57	69.77	86.61
DTModel_glo_pro rolling mean window: 4	89.08	93.28	85.71	74.04	74.29	81.63
DTModel_glo_pro sum alerts min: 2	89.74	91.60	88.24	75.48	72.64	85.69
DTModel_glo_pro sum alerts min: 3	89.47	94.12	85.71	74.00	75.62	80.38
DTModel_glo_pro sum alerts min: 4	88.39	94.96	83.19	70.19	77.30	72.63
DTModel_pro	89.76	82.35	95.80	71.53	56.54	92.25
DTModel_pro mean process tree	90.91	84.03	96.64	72.13	59.38	91.06
DTModel_pro process tree min alerts: 1	90.20	82.35	96.64	64.45	37.04	92.79
DTModel_pro process tree min alerts: 2	90.20	82.35	96.64	64.42	36.97	92.79
DTModel_pro process tree min alerts: 3	90.20	82.35	96.64	64.42	36.97	92.79
DTModel_pro process tree min alerts: 4	90.20	82.35	96.64	64.42	36.97	92.79
DTModel_pro rolling mean window: 2	93.16	94.96	91.60	73.82	66.19	88.40
DTModel_pro rolling mean window: 3	91.77	94.96	89.08	73.49	66.15	87.80
DTModel_pro rolling mean window: 4	90.75	95.80	86.55	72.05	69.38	82.38
DTModel_pro sum alerts min: 2	92.17	95.80	89.08	73.43	67.44	86.56
DTModel_pro sum alerts min: 3	90.75	95.80	86.55	71.53	69.63	81.25
DTModel_pro sum alerts min: 4	89.29	95.80	84.03	67.58	70.81	73.55
DTModel_pro_tree	85.93	73.48	97.48	70.40	43.02	91.57
DTRegression_pro_process	89.06	80.67	95.80	71.62	57.98	91.22
GBDTModel_glo_pro	80.44	63.87	91.60	72.62	59.73	91.71
GBDTModel_glo_pro mean process tree	80.88	63.87	92.44	72.76	60.63	91.22
GBDTModel_glo_pro process tree min alerts: 1	81.75	63.87	94.12	66.32	43.28	92.14
GBDTModel_glo_pro process tree min alerts: 2	81.75	63.87	94.12	66.32	43.28	92.14
GBDTModel_glo_pro process tree min alerts: 3	81.75	63.87	94.12	66.32	43.28	92.14
GBDTModel_glo_pro process tree min alerts: 4	81.75	63.87	94.12	66.32	43.28	92.14
GBDTModel_glo_pro rolling mean window: 2	85.12	83.19	86.55	76.06	71.50	87.80
GBDTModel_glo_pro rolling mean window: 3	84.52	84.03	84.87	75.87	71.82	87.15
GBDTModel_glo_pro rolling mean window: 4	84.12	86.55	82.35	75.25	76.69	81.57
GBDTModel_glo_pro sum alerts min: 2	84.87	84.87	84.87	76.46	75.65	84.66
GBDTModel_glo_pro sum alerts min: 3	85.22	89.08	82.35	74.12	78.77	77.78
GBDTModel_glo_pro sum alerts min: 4	84.44	90.76	79.83	71.99	81.10	72.30
GBDTModel_pro	80.73	62.18	93.28	71.31	58.09	90.51
GBDTModel_pro mean process tree	82.05	64.71	94.12	71.76	59.59	90.14
GBDTModel_pro process tree min alerts: 1	80.71	59.66	94.96	64.88	40.34	91.33
GBDTModel_pro process tree min alerts: 2	80.71	59.66	94.96	64.87	40.30	91.33
GBDTModel_pro process tree min alerts: 3	80.71	59.66	94.96	64.87	40.30	91.33
GBDTModel_pro process tree min alerts: 4	80.71	59.66	94.96	64.87	40.30	91.33
GBDTModel_pro rolling mean window: 2	84.68	79.83	88.24	75.08	71.60	85.91
GBDTModel_pro rolling mean window: 3	84.08	80.67	86.55	74.99	71.71	85.64
GBDTModel_pro rolling mean window: 4	84.39	84.87	84.03	73.91	76.05	79.84
GBDTModel_pro sum alerts min: 2	85.48	84.03	86.55	74.50	74.40	82.33
GBDTModel_pro sum alerts min: 3	85.11	86.55	84.03	72.35	76.77	76.59
GBDTModel_pro sum alerts min: 4	83.84	88.24	80.67	70.17	78.38	71.71
GBDTModel_pro_tree	79.02	59.09	94.96	71.08	46.68	90.51
GBDTRegression_pro_process	89.71	87.39	91.60	71.84	80.57	72.52
MLPModel_glo_pro	66.67	13.45	93.28	57.92	19.00	90.68
MLPModel_glo_pro mean process tree	67.48	16.81	93.28	59.79	25.74	90.51
MLPModel_glo_pro process tree min alerts: 1	67.46	13.45	94.96	57.61	17.64	90.84
MLPModel_glo_pro process tree min alerts: 2	67.46	13.45	94.96	57.61	17.64	90.84
MLPModel_glo_pro process tree min alerts: 3	67.46	13.45	94.96	57.61	17.64	90.84
MLPModel_glo_pro process tree min alerts: 4	67.46	13.45	94.96	57.61	17.64	90.84
MLPModel_glo_pro rolling mean window: 2	67.96	28.57	88.24	58.73	32.20	84.17
MLPModel_glo_pro rolling mean window: 3	67.79	34.45	84.87	58.90	34.31	83.20
MLPModel_glo_pro rolling mean window: 4	68.75	41.18	83.19	58.32	40.55	78.16
MLPModel_glo_pro sum alerts min: 2	68.94	38.66	84.87	59.51	39.19	81.30
MLPModel_glo_pro sum alerts min: 3	69.04	45.38	81.51	58.47	43.17	76.80
MLPModel_glo_pro sum alerts min: 4	70.63	53.78	79.83	57.23	47.72	71.76